Method for activating a data processing device, data processing device and motor vehicle

Abstract

The invention relates to a method for starting up a data processing device (1), in a data memory (2) of which program data (3) comprising a plurality of data segments (4-8), respective check information (9-13) associated with the respective data segments (4-8), and verification information (14) are stored, in a respective starting-up process of the data processing device (1), the program data (3) comprising the plurality of data segments (4-8) being associated with the respective check information (9-13), and the verification information (14) being associated with the respective data segments (4-8). Evaluating a quick start condition (15) dependent on the verification information (14), if the quick start condition (15) is satisfied, selecting at least one of the data segments (4-8) as the data segment (16) to be checked, but not all of the data segments (4-8), and if each data segment (4-8) to be checked satisfies a check condition (17), selecting at least one of the data segments (4-8) as the data segment (16) to be checked, but not all of the data segments (4-8) to be checked only if each data segment (4-8) to be checked satisfies the check condition (17). Starting a program (18) described by the program data (3), the fulfillment of the checking condition also depending on the checking information (9-13) assigned to the respective data segment (4-8) to be checked, selecting all the data segments (4-8) as the data segment (16) to be checked if the quick start condition (15) is not fulfilled, and if the quick start condition (15) is not fulfilled, selecting all the data segments (4-8) as the data segment (16) to be checked. The program (18) is started only if each data segment (16) to be checked satisfies a check condition (17), and the verification information (14) is additionally set to a value that satisfies a quick start condition (15).

Description

Technical Field

[0001] The present invention relates to a method for starting a data processing system, wherein a data memory of the data processing system stores program data comprising a plurality of data segments, corresponding check information assigned to the respective data segments, and authentication information. The present invention also relates to a data processing system and a motor vehicle. Background Art

[0002] In many application areas, especially embedded applications such as those in the automotive sector, ensuring the integrity and authenticity of executed software is often crucial in order to protect it from memory errors and tampering by attackers. For this purpose, in some cases, storing the corresponding software components in the internal memory of a data processing device (e.g., in a control unit or host controller) may be sufficient. However, due to the general need for additional security and the trend towards eliminating internal flash memory or similar devices or at least using additional external flash memory, further approaches to software security are often required.

[0003] One possible approach is the so-called "Secure Boot" method, in which software components are first verified and only started after verification. For example, in US 2019 / 0018669 A1, this method is used to identify erroneous updates and, in such cases, to roll back to a valid previous version.

[0004] Especially when relatively extensive software needs to be verified (as is increasingly the case in embedded applications) and a high level of tamper resistance must be achieved through cryptographic verification procedures (e.g. signature checks), comprehensive software verification before system startup can lead to significant system startup delays, as the computing power available in embedded applications is often very limited. This can lead to user acceptance issues, for example in the automotive sector.

[0005] Another method for verifying software is to check the software only after startup and, if an error occurs, write a corresponding message to an error memory, terminate the function, or similar actions. This is also called "Authenticated Boot." Although this method avoids long wait times when starting the software and is well suited for detecting tampering attempts, such as fraudulently gaining access to self-locking functions or tampering with maintenance intervals, it initially runs the software component in an undefined, potentially tamper-proof state, making it unusable or at least not directly applicable in many applications (for example, when providing driving-related functions in motor vehicles).

[0006] US 2016 / 0306976 A1 discloses a method for checking software, which may be part of an operating system loaded at startup. First, the software is verified using a pre-generated verification tag (e.g., a message authentication code obtained from a previous software authentication). If this check succeeds, the software is executed. Otherwise, the software is authenticated by checking its cryptographic signature.

[0007] Document US2015 / 0074384A1 proposes that, in addition to the stored programs, multiple legal sub-hash values and a legal hash value are also stored. The legal program is divided into multiple legal sub-programs, wherein the corresponding first legal sub-hash value is calculated based on one of the legal sub-programs. The legal hash value is calculated based on the legal sub-hash value. When the system starts, a calculated hash value is calculated based on the stored legal sub-hash value, and the calculated hash value is compared with the legal hash value. If they match, the startup process continues. After startup, the corresponding calculated sub-hash value is calculated for the corresponding actually existing sub-program, and compared with the corresponding stored legal sub-hash value, wherein if the corresponding calculated sub-hash value does not match the legal sub-hash value, the system stops running.

[0008] Document US2022 / 0179960A1 proposes performing firmware verification based on firmware management parameters, which can be set on the application side after entering a password. For example, the firmware management parameters can determine whether to perform partial or probabilistic verification, full verification, or no verification at all. Summary of the Invention

[0009] Therefore, the object of the present invention is to provide an improved method for starting a data processing device, by which the respective disadvantages of the two aforementioned methods, namely “secure start” and “authenticated start”, can be reduced or at least avoided.

[0010] This object is achieved by a method of the type mentioned at the outset, wherein during a corresponding startup process of the data processing system, a fast startup condition that is dependent on the authentication information is evaluated.

[0011] - wherein, if a fast start condition is satisfied, at least one of the data segments, but not all of the data segments, is selected as data segments to be checked, and the program described by the program data is started only if each data segment to be checked satisfies a check condition, wherein the satisfaction of the check condition also depends on the check information assigned to the respective data segment to be checked, and

[0012] - wherein, if the fast start condition is not satisfied, all data segments are selected as data segments to be checked, wherein only if each data segment to be checked satisfies the check condition, the program is started and the verification information is additionally set to a value that satisfies the fast start condition.

[0013] According to the present invention, verification information or rapid boot condition evaluation is used so that, at least during some boot processes—i.e., when the rapid boot conditions are met—only one or at least not all of the data segments are checked. This significantly reduces the time required to evaluate the check conditions for the data segments to be checked. For example, if only 20% or 40% of the data segments are checked, the boot process can be sped up by a factor of 2 to 5. However, by sampling and checking one or more of the data segments, many problems, such as storage errors, can be reliably identified.

[0014] This fast start can be used when it can already be assumed with a high probability that valid program data are present, i.e., in particular, when all data segments were checked during a previous start because the fast start conditions were not met and all data segments were found to be valid. If, however, a check of further data segments, for example, performed during operation, detects that the program data may be invalid, and / or if the program data has been modified (e.g., within the framework of an update), and / or if other indicators of potential manipulation or errors (e.g., replacement of components and / or opening of the housing, etc.) are detected, the verification information can be set to a value that does not meet the fast start conditions, so that a comprehensive check of the program data is performed again during a restart.

[0015] Thus, with the proposed method, approximately the same robustness as the “safe start” method can be achieved, but correspondingly significantly shorter start times can be achieved, at least in most start processes.

[0016] In particular, if the verification information has a specific value, the fast start condition is satisfied; otherwise, it is not satisfied. For example, the verification information can be a Boolean value, thereby indicating whether a fast start should be performed. If, during a fast start, or if the fast start condition is satisfied, at least one of the data segments to be checked subsequently fails to satisfy the check condition, the verification information can also be set to a value indicating that the fast start condition is not satisfied. In this case, restarting the data processing device always results in a check of all data segments, because if a data segment is incorrect or tampered with, there is a risk that at least another data segment will also be incorrect or tampered with.

[0017] In the simplest case, the check condition can be to compare a checksum specified by the check information with the checksum for the corresponding data segment and / or to perform a cyclic redundancy check (CRC) using the check information. However, in particular when it is necessary to robustly detect intentional manipulation of the data segment by an attacker, it can be advantageous to additionally or alternatively use a cryptographic hash value of the data segment as check information and / or to perform a signature check on the code signature using this check information.

[0018] If the verification condition for at least one of the data segments to be verified is not met, the startup of the data processing device is preferably aborted or stopped, regardless of whether the fast startup condition is met. This startup error can be output directly by an output component of the data processing device or communicated to other devices (e.g., other components of the vehicle), for example, to enable a fallback operation without using the data processing device or to prevent the startup of a higher-level device.

[0019] The data memory may include various memory segments or modules, particularly those accessible by different components of the data processing system or higher-level devices with different authorizations. If the data processing system includes, for example, a check device for evaluating check conditions and an execution device for executing a program, authentication information can be written only by the check device. For example, write access to a memory area containing program data or check information is permitted only by authorized components or devices. For example, write access to check information may be permitted only by a key management system of a higher-level device (e.g., a motor vehicle).

[0020] The checking device can be, for example, a security controller, which can be implemented as a trusted domain or hardware security module (HSM). For example, a host controller can serve as the execution device. The checking device and / or the execution device can each be implemented by a microcontroller, but can also be implemented by other processors or the like.

[0021] Preferably, at least that portion of the data memory in which the program data and the test information, and preferably also the authentication information, are stored is designed such that these data memory portions retain their contents even when the power supply is off or after the program is stopped. For example, the data memory, or at least a portion of the data memory, can be formed by a flash memory, an EEPROM, or the like.

[0022] When the fast start condition is met, after the program is started, for at least one additional data segment that was not selected as the data segment to be checked before the program was started, or for all additional data segments that were not selected as the data segments to be checked before the program was started, it can be checked whether the corresponding additional data segment and the assigned check information meet the check condition, wherein, when the additional data segment or at least one of the additional data segments does not meet the check condition, the verification information can be set to a value that does not meet the fast start condition, and / or recorded in the error memory of the data processing device.

[0023] By checking one or more additional data segments after the program has started, this check does not delay the startup process and can be performed in the background, thus being unnoticeable to the user of the data processing device or a user of a higher-level device. However, unlike the previously described "authenticated startup" method, the check of all program data is not relocated to after the device has started; rather, at least some of the data segments are checked before the program has started. This further improves the robustness of data processing compared to conventional "authenticated startup" methods, even in the case of fast startups.

[0024] The checking of one or more further data segments can be carried out immediately, or at least shortly after the program is started. In addition or as an alternative, however, it is also advantageous to repeat the checking of further data segments that have not been checked so far, or data segments that have already been checked, at intervals in time during operation, as will be described further below.

[0025] If at least one of the other data segments does not meet the check condition, the modification of the verification information results in a check of all data segments during the next startup of the data processing system, and a robust restart is prevented if the corresponding error or corresponding manipulation has not been corrected by then. Depending on the extent to which manipulation or errors in a specific data segment negatively impacts the operational reliability of the data processing system or a higher-level device, it may be sufficient to record the corresponding error in an error memory, or it may be expedient to perform such error recording in addition. The error memory may be part of the data memory or may also be designed separately from the data memory.

[0026] After the program is started, at least one corresponding data segment can be selected at multiple time-spaced check time points and checked to see whether the data segment and the corresponding assigned check information meet the check conditions. If the check conditions are not met, the verification information can be set to a value that does not meet the fast start conditions and / or registered in an error memory or an error memory of the data processing device.

[0027] By checking the data segments at multiple, time-spaced check points after program startup, several advantages can be achieved. On the one hand, the computing power required to check the program data, or at least the portion of the program data to be checked, can be made available over a longer period of time. This can be achieved, for example, by checking one or more data segments periodically or whenever free computing power is available. On the other hand, data segments can be repeatedly checked over longer runtime periods to detect manipulations or errors during operation. This latter approach (repeated checking of data segments) can also be advantageous if the fast startup conditions are not met during the initial startup of the data processing system.

[0028] For at least some of the inspection time points, different data segments can be selected and checked for compliance with the inspection conditions. This allows, in particular, the entire program data to be distributed across multiple inspection time points for inspection. In the simplest case, the data segments selected at each respective inspection time point can be randomly selected. Using a sufficient number of inspection time points allows the entire program data to be checked with at least a high probability. Alternatively, however, a fixed order of data segments to be selected can be used, or, for example, a random selection can be made from data segments that have not yet been inspected or that have not been inspected within a certain period of time.

[0029] Additionally or alternatively, when the fast startup condition is satisfied, the data segments to be checked may be randomly selected, and / or the data processing device may be started at multiple startup time points separated in time, wherein the selection of at least one data segment to be checked is different for at least two of the startup time points that satisfy the fast startup condition. The latter may be achieved, for example, by random selection, but may also be achieved by a fixed order of selected data segments, or the like.

[0030] By selecting different data segments using different probabilities or by predefining a suitable checking sequence, it is possible, for example, to check certain data segments (e.g., particularly those related to the robustness of the provided functionality) more frequently than other data segments. By randomly selecting the data segments to be checked during a quick start or by using a variable selection during successive startups, sampling checks can detect tampering or errors in any data segment even during multiple quick starts.

[0031] Before the startup process or at least one startup process of the data processing device, at least one data segment can be modified or overwritten to change the program, wherein the verification information is set to a value that does not meet the fast startup condition. Specifically, the data segment can be written, especially during an update process provided by an external device. For example, only when the verification information is set to a value that does not meet the fast startup condition is a write access to modify one of the data segments opened / triggered, or each write access automatically results in a corresponding change in the verification information. Therefore, in this approach, the change in program data automatically causes the fast startup condition to be not met during the next startup process, and the entire program data is then checked. Only after an initial comprehensive check of the program data after such a change can a fast startup be performed again.

[0032] The content of at least one data segment and the check information assigned to the data segment can be provided to the data processing device by different devices, wherein the check information is provided in particular via a key management system for managing cryptographic keys used in the data processing device.

[0033] Additionally or alternatively, when providing modified inspection information, the modified inspection information may only be used as one of the inspection information if, on the one hand, the source of the modified inspection information has been authenticated by the data processing device or an authentication module of the data processing device, and / or if, on the other hand, authentication information satisfying the authentication conditions is assigned to the modified inspection information.

[0034] The authentication information can be, in particular, a digital signature or the like. The origin of the control information can be authenticated using methods known per se, such as cryptographic challenge-response methods. Providing the control information using key management is particularly advantageous, since key management already has a suitable infrastructure for providing keys, which typically includes corresponding authentication mechanisms.

[0035] Program data or modified data segments can be loaded, for example, via a maintenance module in a workshop or generally within the scope of maintenance. This typically requires authentication of the maintenance module with respect to the data processing system or a higher-level device (e.g., a vehicle). Therefore, if the program data or the contents of the modified data segment and the check information are provided by different devices, requiring authentication of the source or data, both sources must be independently authenticated by the data processing system or, for example, the vehicle, in order to enable program changes. This creates a two-factor authorization mechanism.

[0036] The checking of whether the data segments to be checked and the associated check information meet the check conditions and the execution of the program can be performed by different data processing components of the data processing device. The data processing device can particularly include the above-mentioned checking device and the above-mentioned execution device as data processing components.

[0037] Additionally or alternatively, data processing by at least one data processing component (particularly an execution device) of the data processing device is only enabled after all data segments to be checked satisfy the check conditions. In other words, a "safe start" method can be implemented for the data segments to be checked, but not all data segments will be checked before startup if the fast start conditions are met.

[0038] The evaluation of fast startup conditions and / or check conditions can be implemented by a boot loader stored in the data memory of the data processing device. The program startup and / or check condition evaluation only occurs if the boot loader satisfies initialization conditions (which in turn depend on reference information stored in the data memory). In addition to the other input data used, the initialization conditions can correspond to the check conditions, or be implemented as described above regarding the check conditions. For example, the initialization conditions can compare a checksum with reference information, perform a cyclic redundancy check (CRC) using the reference information, and the reference information can be a cryptographic hash value or code signature of the boot loader, etc.

[0039] By additionally checking the boot loader, the robustness and security against manipulation of the data processing device can be further increased.

[0040] In addition to the method according to the invention, the present invention also relates to a data processing device having a data memory, wherein the data processing device is configured to execute the method according to the invention. The data processing device particularly comprises at least one data processing component for evaluating test conditions and fast start conditions and executing a program. Preferably, multiple data processing components are used, in particular the aforementioned test device and the aforementioned execution device.

[0041] Therefore, the data processing device may include at least one checking device and at least one execution device, wherein the checking device may be configured to evaluate a fast start condition and a checking condition and to trigger program execution by the execution device if all data segments to be checked satisfy the checking condition.

[0042] The data processing device according to the invention can be further developed using the features explained with respect to the method according to the invention in order to obtain the advantages mentioned in the method, and vice versa.

[0043] The present invention also relates to a motor vehicle comprising a data processing device according to the present invention. The use of such a data processing device in a motor vehicle is particularly advantageous, as many applications in motor vehicles require both high reliability and rapid system startup. As described above, this integration can be achieved using the method according to the present invention or using the data processing device according to the present invention. In principle, the data processing device can be used for any purpose in a motor vehicle, for example, to implement driving functions, multimedia functions, assistance systems, and the like. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Further advantages and details of the present invention will be apparent from the following examples and drawings, which are schematically shown here:

[0045] Figure 1 An embodiment of a motor vehicle according to the invention is shown, which comprises an embodiment of a data processing device according to the invention;

[0046] Figure 2 a flow chart showing an embodiment of a method according to the present invention; and

[0047] Figure 3 It shows that the data processing equipment can be operated continuously. Figure 2 Other steps performed in the method shown. DETAILED DESCRIPTION

[0048] Figure 1 A data processing device 1 is shown, which Figure 1 The data processing device, shown only schematically in FIG, is part of a motor vehicle 23 and can implement, for example, driving-related functions and / or multimedia functions in the motor vehicle. In particular, when implementing driving-related functions, it is important that the program 18 or all programs to be executed by the data processing device 1 are fully verified. This allows malfunctions, for example caused by storage errors or manipulation, to be detected in good time in order to avoid impairment of driving operation.

[0049] In order to achieve robust error detection while avoiding long startup times (e.g., requiring a complete check of program data 3 each time data processing device 1 is started), data processing device 1 uses a hybrid verification method, wherein only portions of program data 3 are checked before program 18 begins execution, at least when the program data 3 are expected to be valid. This significantly speeds up startup for most startup processes.

[0050] Also refer to Figure 2 Explaining a method for starting a data processing device 1, Figure 2A flow chart shows an exemplary embodiment of this method. Importantly, the data memory 2 of the data processing device 1 (which, in practice, can also consist of multiple memory modules using the same or different memory technologies) contains not only program data 3 divided into multiple data segments 4 to 8, but also check information 9 to 13 assigned to each data segment 4 to 8. Furthermore, verification information 14 is stored in the data memory, indicating whether the program data 3 is expected to be valid and therefore satisfies a fast start condition 15. If the fast start condition is met, a fast start is enabled because only a portion of the data segments 4 to 8 is selected as a data segment 16 to be checked before starting the program 18.

[0051] If, on the other hand, the fast start conditions are not met, all data segments will be checked, so that, for example, after updating the program data 3 or after detecting an action that may involve a manipulation attempt or maintenance work, a longer startup will be required in order to ensure a robust check of the program data 3.

[0052] exist Figure 1 In the example shown, the data processing itself is performed by two data processing components 19 and 20, wherein the data processing component 19 is a checking device 21, which is used to perform a check of the program data 3 or an evaluation of the check conditions 17, and the data processing component 20 is an execution device 22, which is only started after the check of the data segment 16 to be checked is completed and it is triggered by the checking device 19.

[0053] exist Figure 2 In the illustrated embodiment, data processing device 1 is started at startup time 27 in step S1, for example, by starting to supply power to data processing device 1, or in motor vehicle 23, by connecting "terminal 15," i.e., when vehicle startup conditions are met. However, depending on the functionality implemented by data processing device 1, the data processing device may also be started at other startup times 27, for example, only when certain components in the motor vehicle are activated or certain sensor signals are present.

[0054] exist Figure 1 In the embodiment shown, the fast start condition 15 and the check condition 17 are checked by a boot loader 36 of the data processing device 1, which is also stored in the data memory 2 and is executed immediately after the check device 21 starts the data processing device 1. However, the execution device 22 initially remains inactive.

[0055] In step S2, a self-test is first performed by the boot loader 36. In particular, a check is performed to determine whether the boot loader 36 satisfies initialization conditions 38, which in turn depend on reference information 37. Reference information 37 may be, for example, a cryptographic hash value of the data of the boot loader 36 or may also be used to check a code signature of the boot loader 36. If the self-test fails, or if initialization conditions 38 are not met, the method immediately ends in step S8, where the operation of the data processing system 1 is terminated and an error signal is output, for example, to an external device (not shown) of the motor vehicle 23.

[0056] However, if initialization condition 38 is satisfied, then in step S3 boot loader 36 checks fast start condition 15, the satisfaction of which depends on verification information 14. In the simplest case, verification information 14 is a Boolean value, and fast start condition 15 is satisfied precisely when the value of verification information 14 is "true." In this case, verification information 14 indicates whether program data 3 can be assumed to be valid. Therefore, within the framework of an update of data processing device 1 or, in other words, during the first startup after initial manufacture and programming of data processing device 1, after at least one of data segments 4 to 8 has been modified, verification information 14 will initially have a value that does not satisfy fast start condition 15, so that in this case the method continues with step S4.

[0057] In step S4, since the quick start condition 15 is not met, all data segments 4 to 8 of the program data 3 are selected as data segments to be checked, and each data segment 4 to 8 is checked to see whether the following check condition 17 is met, which also depends on the check information 8 to 13 assigned to each data segment 4 to 8 to be checked.

[0058] In addition to the different input data, the check condition 17 corresponds in particular to the initialization condition 38 and can therefore, for example, check whether the cryptographic hash values or code signatures stored as check information 9 to 13 are valid for the corresponding data segments 4 to 8. If at least one of the data segments 4 to 8 is invalid, i.e., if the check condition 17 is not satisfied at least once, then the method branches again to step S8 and ends with the data processing system 1 being stopped.

[0059] However, if all data segments 4 to 8 satisfy the check condition, the entire program data 3 passes the verification, so that in step S5 , the verification information 14 may first be set to a value that satisfies the fast start condition 15 .

[0060] Subsequently, in step S6 , program 18 can be started, so that data processing device 1 can provide functions to a user or other components of motor vehicle 23 .

[0061] in this case, Figure 2 The method shown ends with step S7, in which the normal operation of the data processing device 1 or the continued execution of the program 18 takes place. If the operation of the data processing device 1 is interrupted at any time, for example due to the parking of the motor vehicle 23 or the switching off of certain components of the motor vehicle 23, and the authentication information 14 is not changed during this operation, but is restarted at a later start-up time 27 and is then repeated later Figure 2 When the method step S3 shown in FIG. 1 is completed, the fast start condition 15 is satisfied, so in this case the method continues with step S9 .

[0062] In step S9 , at least one (but not all) of data segments 4 to 8 is first selected as data segment 16 to be checked. The number of data segments to be selected can be optimized based on the reasonable startup time of data processing device 1 , for example, through experiments combined with user experience. In principle, only one of data segments 4 to 8 can be selected as data segment 16 to be checked; however, selecting multiple data segments 16 to be checked in step S9 can further improve the robustness of the check.

[0063] The selection of the data segments 16 to be checked is preferably performed in such a manner that, at different startup times 27 when the fast startup condition 15 is satisfied, different data segments 16 to be checked, or different groups of data segments 16 to be checked, are selected so that, after multiple startup processes, all data segments 4 to 8 have been checked at least once with a high probability. This can be achieved, for example, by randomly selecting one or more data segments 16 to be checked in step S9. Alternatively, however, a fixed order can be predefined, according to which the selected data segments 16 to be checked are rotated.

[0064] In step S10, only the data segments 16 to be checked that were selected in step S9, and therefore not all data segments 4 to 8, are checked individually to see whether these data segments and the corresponding associated check information 9 to 13 satisfy check condition 17. Step S10 corresponds to step S4, except that check condition 17 is not checked for all data segments 4 to 8 of program data 3 in step S10. Therefore, if check condition 17 is not satisfied for at least one data segment 16 to be checked, the method branches to step S8 and terminates by stopping data processing system 1.

[0065] If, on the other hand, the check condition 17 is satisfied for all the data segments 16 to be checked in step S10, the program 18 is started in step S11. Since, on the one hand, the quick start condition 15 is satisfied, or the value of the verification information 14 indicates that the program data 3 is expected to be valid, and the data segments 16 to be checked, which were randomly selected in step S9, are actually valid because they satisfy the check condition 17, it can be assumed with a high degree of confidence that the program 18 will not be started with problems.

[0066] exist Figure 2 In the illustrated embodiment, immediately after the program 18 is started in step S11, further data segments 24 that were not selected as data segments 16 to be checked in step S9 are selected in step S12, and in step S13, these further data segments 24 or the check information 9 to 13 assigned to them are checked to see whether they satisfy the check condition 17. Therefore, the quick start in the illustrated embodiment differs from the start via steps S4 to S6 in that, in the quick start, for some of the data segments 4 to 8, the check condition 17 is not checked until after the program 18 has been started.

[0067] If the check condition 17 is also met for the further data segments 24 , operation can be continued normally in step S7 and all program data 3 are verified, as in a normal startup without fast startup.

[0068] If, on the other hand, the check condition 17 is not satisfied for at least one further data segment 24, an error handling is initially performed in step S14. On the one hand, the verification information 14 is set to a value that does not satisfy the fast start condition 15 during the restart, so that the next time the data processing system 1 is started, all program data 3 must be completely verified in order to be able to start. Furthermore, a corresponding entry is made in the error memory 25 to facilitate diagnosis or correction of the error.

[0069] In an alternative design, only some of the data segments 4 to 8 not selected in step S9 may be selected for checking in step 12, or steps S12 to S14 may be omitted completely, because reference will still be made to the following. Figure 3 To explain, during normal operation of the data processing device 1, the check of data segments 4 to 8 can still be performed at a later point in time, or because during repeated startups, the selection of the data segments 16 to be checked changes in step S9, the data segments can be checked continuously over multiple startups.

[0070] Figure 3 The subsequent steps S15 to S26 are shown, which can be performed during the continuous operation of the data processing device 1, i.e. when the Figure 2 Step S7 in the process is executed. Figure 3 The flowchart shown starts at step S15, in which the program 18 is executed. In step S16, one of the data segments 4 to 8 is selected at the respective check time 26, wherein the data segments can be selected randomly or in a defined order.

[0071] Subsequently, in step S17 , it is checked whether the data segments 4 to 8 selected in step S16 and their assigned check information 9 to 13 satisfy the check condition 17 .

[0072] If the check condition 17 is not met in S17, the verification information 14 is set to a value that does not meet the fast start condition 15 in step S18 and / or is recorded in the error memory 25. This makes it possible, in particular, for the data processing device 1 to perform a complete check of the program data 3 at the next startup.

[0073] Regardless of whether the check condition 17 is met in step S17, a check is performed in step S19 to determine whether the program data 18 should be updated. If the program data should not be updated, a check is performed in step S20 to determine whether the operation of the data processing system 1 should be terminated, which may depend on, for example, the terminal status of the motor vehicle 23 or the power supply of the data processing system 1.

[0074] If the operation is continued, the method is continued in step S16, in particular after a certain waiting time, in order to check data segments 4 to 8 again at a new check time 26. If the operation is terminated, the method ends in step S26, wherein the operation or the method can be restarted with step S1 at a later start time 27 (for example, when the terminal status of the motor vehicle changes again).

[0075] In order to update the program data, or generally to overwrite or modify the content of at least one of the data segments 4 to 8, the content of the corresponding data segment 4 to 8 or the program data 18 is first provided via a first source 28 (e.g., a service terminal within the framework of maintenance). In particular, device 28 can only gain write access to data memory 2 or specifically to data segments 4 to 8 if the provided content or device 28 is correspondingly authenticated (this can be checked in step S22).

[0076] In step S23, correspondingly modified check information 31 is provided for all data segments 4 to 8 to be modified via another source 29 (e.g., a backend for key management) via the key management system 30 of the motor vehicle 23, with authentication information 34 also being transmitted. Subsequently, in step S24, authentication module 22 of the data processing system 1 evaluates authentication conditions 35, which check whether the authentication information 34, or the authentication of the source 32, allows access to a protected storage area 39 in which the previous check information 9 to 13 is stored. Otherwise, they cannot be replaced.

[0077] Therefore, a two-factor authentication mechanism is required to load executable program data into data processing device 1. On the one hand, device 28 must be authorized to load program data 18 itself. On the other hand, authorization must be obtained through key management system 30 to update check information 9 to 13 and prevent program 18 from becoming unbootable after such modifications.

[0078] As the content of the data memory 2 is changed in steps S21 to S24, the verification information 14 must be set in step S25 to a value that does not satisfy the fast startup condition 15. Therefore, after executing steps S21 to S25, all program data 3 must be checked in step S4 the next time the data processing device 1 is started, because a fast startup is not performed.

[0079] However, as described above, since the verification information 14 is set to a value that satisfies the fast startup condition 15 after the first full verification, only one slow startup is usually required after the program data 18 is changed or updated, and the data processing device 1 can then be started again via the fast startup, and thus in a significantly shorter time. Therefore, the proposed method significantly improves the user experience.

Claims

1. A method for starting a data processing device (1), wherein: In a data memory (2) of a data processing device (1) are stored: program data (3) comprising a plurality of data segments (4-8), corresponding check information (9-13) assigned to the respective data segments (4-8), and verification information (14), characterized in that: During a corresponding startup process of the data processing device (1), a fast startup condition (15) is evaluated which is dependent on the authentication information (14), - wherein, if a fast start condition (15) is satisfied, at least one of the data segments (4-8), but not all of the data segments (4-8), is selected as a data segment to be checked (16), and the program (18) described by the program data (3) is started only if each data segment to be checked (4-8) satisfies a check condition (17), the satisfaction of which also depends on the check information (9-13) assigned to the respective data segment to be checked (4-8), - wherein, if the fast start condition (15) is not satisfied, all data segments of the data segments (4-8) are selected as data segments to be checked (16), wherein, only if each data segment to be checked (16) satisfies the check condition (17), the program (18) is started and the verification information (14) is additionally set to a value that satisfies the fast start condition (15).

2. The method according to claim 1, characterized in that If the fast start condition (15) is met, after the program (18) is started, for at least one further data segment of the data segment (24) that was not selected as the data segment (16) to be checked before the program (18) is started, or for all further data segments (24) that were not selected as the data segment (16) to be checked before the program (18) is started, it is checked whether the corresponding further data segment (24) and the check information (9-13) assigned thereto meet the check condition (17), wherein, if the further data segment (24) or at least one of the further data segments (24) does not meet the check condition (17), the verification information (14) is set to a value that does not meet the fast start condition (15) and / or is recorded in an error memory (25) of the data processing device (1).

3. The method according to claim 1 or 2, characterized in that After the program is started, at a plurality of temporally spaced check time points (26), at least one corresponding data segment of the data segments (4-8) is selected and checked to see whether the data segment (4-8) and the correspondingly assigned check information (9-13) satisfy a check condition (9-13), wherein, if the check condition (9-13) is not satisfied, the verification information is set to a value that does not satisfy the fast start condition (15) and / or is recorded in an error memory (25) of the data processing device (1).

4. The method according to claim 3, characterized in that For at least a portion of the inspection time points (26), different data segments (4-8) are selected and these data segments are checked to see whether they satisfy the inspection condition (17).

5. The method according to any one of the preceding claims, characterized in that The data segments (16) to be checked are selected randomly when a fast start condition (15) is satisfied, and / or the startup of the data processing device (1) is performed at a plurality of startup time points (27) spaced apart in time, wherein the selection of at least one data segment (16) to be checked is different for at least two of the startup time points (27) at which the fast start condition (15) is satisfied.

6. The method according to any one of the preceding claims, characterized in that During a startup process or before at least one startup process of the data processing device (1), at least one of the data segments (4-8) is modified or overwritten to change the program (18), wherein the verification information (14) is set to a value that does not satisfy the fast startup condition (15).

7. The method according to any one of the preceding claims, characterized in that The content of at least one of the data segments (4-8) and the check information (9-13) assigned to the data segment (4-8) are provided to the data processing device (1) by different devices (28, 29), wherein the check information (9-13) is provided in particular via a key management system (30) for managing encryption keys used in the data processing device (1), and / or, when providing modified check information (31), this modified check information can only be used as one of the check information (9-13) if, on the one hand, the source (32) of the modified check information (31) has been authenticated by the data processing device (1) or by an authentication module (33) of the data processing device (1), and / or if, on the other hand, authentication information (34) that meets an authentication condition (35) is assigned to the modified check information (31).

8. The method according to any one of the preceding claims, characterized in that The checking of whether the corresponding data segments (16) to be checked and the check information (9-13) assigned thereto meet the check condition (17) and the execution of the program (18) are carried out by different data processing components (19, 20) of the data processing device, and / or data processing by at least one data processing component (20) of the data processing device (1) is only released when all data segments (16) to be checked meet the check condition (17).

9. The method according to any one of the preceding claims, characterized in that The evaluation of the fast start condition (15) and / or the check condition (17) is carried out by a boot loader (36) of the data processing device (1) and stored in the data memory (2), wherein the program (18) is started and / or the check condition (17) is evaluated only if the boot loader (36) meets an initialization condition (38), which in turn depends on the reference information (37) stored in the data memory (2).

10. A data processing device having a data memory (2), characterized in that The data processing device is configured to carry out the method according to any one of the preceding claims.

11. The data processing device according to claim 10, characterized in that The data processing device comprises at least one checking device (21) and at least one execution device (22), wherein the checking device (21) is configured to evaluate a fast start condition (15) and a checking condition (17), and trigger the execution of a program (18) by the execution device (22) when all data segments (16) to be checked satisfy the checking condition (17).

12. A motor vehicle, characterized in that: The motor vehicle comprises a data processing device (1) according to claim 10 or 11.

Images